Alexandergull

**Name of the Vulnerable Software and Affected Versions** Anti-Spam by CleanTalk versions 0.0.0 through 9.7.1 **Description** Reflected Cross-site Scripting (XSS) occurs when the module fails to sufficiently sanitize API response messages before rendering them in HTML output. Specifically, the ` cleantalk die()` and `ct die()` functions output the CleanTalk API response message directly into HTML, which allows the injection of arbitrary HTML or JavaScript. Exploitation requires the attacker to influence the CleanTalk cloud API response, such as through a man-in-the-middle attack or a compromised API server. **Recommendations** Update Anti-Spam by CleanTalk to a version newer than 9.7.1.